Validated payload execution

ABSTRACT

A request to sign a provided payload is received, wherein the payload includes an automation script specified to execute on one or more management service instances. The automation script is validated, including by modifying the payload to add metadata data associated with the validation. An encrypted version of a digital signature private key that was received is sent to a credential system. An unencrypted version is received and used to sign the modified payload. The signed modified payload is provided in response to the request to sign the provided payload. The signed modified payload is configured to, in response to a request to execute the automation script on the one or more of the management service instances, be verified using a public key corresponding to the digital signature private key and allow a validation of the automation script at least in part by using the included added metadata.

BACKGROUND OF THE INVENTION

Cloud-based solutions allow businesses to rapidly build and deploysoftware applications. These solutions allow customers to direct theirfocus on business needs by replacing significant portions of the ITmanagement with a unified cloud-hosted service platform. Unlikeself-hosting, cloud-hosted software and hardware can be quickly scaledup and down to provide customers with increased flexibility and control.Using a unified cloud-hosted service platform, customers can also easilyadd new business applications including the ability to automate andextend business workflows that are not traditionally digital. Althoughmuch of the IT responsibility is removed when utilizing a cloud-basedsolution, some customers may still desire to run their own applicationscripts on the cloud-hosted service instances managed using acloud-hosted service platform. For example, these application scriptscan be used to customize the monitoring and configuration of cloud-basedhardware and deployed software.

BRIEF DESCRIPTION OF THE DRAWINGS

Various embodiments of the invention are disclosed in the followingdetailed description and the accompanying drawings.

FIG. 1 is a block diagram illustrating an example of a secure deploymentplatform for automation scripts.

FIG. 2 is a flow chart illustrating an embodiment of a process forsecurely deploying an automation script to execute on management serviceinstances.

FIG. 3 is a flow chart illustrating an embodiment of a process forsecurely deploying an automation script to execute on management serviceinstances.

FIG. 4 is a flow chart illustrating an embodiment of a process forprovisioning a secure deployment platform for automation scripts.

FIG. 5 is a flow chart illustrating an embodiment of a process forsigning an automation script payload.

FIG. 6 is a flow chart illustrating an embodiment of a process forexecuting a signed automation script payload.

FIG. 7 is a block diagram illustrating the execution and communicationprocess for securely deploying an automation script to execute onmanagement service instances.

FIG. 8 is a diagram illustrating the process of securely deploying anautomation script to execute on management service instances.

DETAILED DESCRIPTION

The invention can be implemented in numerous ways, including as aprocess; an apparatus; a system; a composition of matter; a computerprogram product embodied on a computer readable storage medium; and/or aprocessor, such as a processor configured to execute instructions storedon and/or provided by a memory coupled to the processor. In thisspecification, these implementations, or any other form that theinvention may take, may be referred to as techniques. In general, theorder of the steps of disclosed processes may be altered within thescope of the invention. Unless stated otherwise, a component such as aprocessor or a memory described as being configured to perform a taskmay be implemented as a general component that is temporarily configuredto perform the task at a given time or a specific component that ismanufactured to perform the task. As used herein, the term ‘processor’refers to one or more devices, circuits, and/or processing coresconfigured to process data, such as computer program instructions.

A detailed description of one or more embodiments of the invention isprovided below along with accompanying figures that illustrate theprinciples of the invention. The invention is described in connectionwith such embodiments, but the invention is not limited to anyembodiment. The scope of the invention is limited only by the claims andthe invention encompasses numerous alternatives, modifications andequivalents. Numerous specific details are set forth in the followingdescription in order to provide a thorough understanding of theinvention. These details are provided for the purpose of example and theinvention may be practiced according to the claims without some or allof these specific details. For the purpose of clarity, technicalmaterial that is known in the technical fields related to the inventionhas not been described in detail so that the invention is notunnecessarily obscured.

A secure deployment platform for executing validated applications isdisclosed. For example, using the disclosed techniques, a customer of acloud-based service platform can execute an application such as anautomation script on a set of target management service instances. Theautomation script can be executed via the cloud-based service platformand used to automate the management of the instances. In someembodiments, the scripts are uploaded to a central location such as afront-end to a cloud platform before being eventually deployed to theinstance target endpoints for execution. The results of the deployedapplication executions can be returned to the requester. In someembodiments, the automation scripts are used for analytics,configuration, management, or another appropriate task. The ability todeploy the scripts to multiple target instances allows for efficient andflexible administration of management service instances.

In various embodiments, the application scripts are deployed to targetinstances as a validated payload. This validation and deployment can becompleted over multiple steps that are each hardened to improve securityand ensure that only authorized applications can be executed on theappropriate target instances by the appropriate users. At each step,security techniques are deployed to limit the exposure to threats. Forexample, in response to a user deployment request of an automationscript, the script can only be uploaded to the cloud service platformafter a user is authenticated with a requester. In some embodiments, therequester runs as a requester service. The requester service will itselfmutually authenticate with a signature server and request to thesignature server that the automation script be signed. In someembodiments, as part of the signature request, the request to executethe automation script must specify the target management serviceinstances on which to run the automation script. At the signatureserver, the requester and target instances can be compared to one ormore whitelists, such as domain, sub-domain, and IP address whitelists.The whitelists can include ranges such as one or more IP address ranges.In some embodiments, a whitelist is specified using wildcards and/orregular expressions. Once validation at the signature server iscomplete, a payload including the automation script and additionalmetadata associated with the payload validation can be signed using aprivate key. The signed payload is returned to the requester where it isthen forwarded to an execution server. In various embodiments, theprivate key used to sign the payload is stored in an encrypted formatand is only decrypted by accessing a credential vault.

In some embodiments, an execution server receives a signed payloadassociated with an automation script that includes additional metadataassociated with validation. The execution server performs a series ofadditional validations such as validating the origin of the request withone or more whitelists. The signed payload is then verified using thecorresponding public key (or certificate) of the private key used by thesignature server. In some embodiments, the payload includes anassociated signed security token. In some embodiments, the securitytoken includes the target instances and/or the account settings and/orprivileges that should be utilized when deploying the automation scripton the target instances. In some embodiments, the security tokenspecifies execution configuration parameters such as an expiration timeor expiration date of the token. In some embodiments, the executionconfiguration includes an execution count. For example, a token can beconfigured for only one-time use. As another example, a token can beconfigured for multiple uses and/or specify that the total executioncount should not exceed the maximum count.

In some embodiments, once validation at the execution server iscomplete, the automation script is extracted from the payload anddeployed to the target management service instances for execution. Theautomation scripts can gather return results which are returned back tothe execution requester. For example, a script result is returned to therequester and can include analytics information, configurationinformation, configuration results, etc. In some embodiments, theautomation results are written to a results data store such as acustomer database. In some embodiments, the results can also be returnedto the original user who requested the automation script deployment viaa user interface of the cloud service platform.

In various embodiments, the secure deployment platform allows anautomation script to be executed only after multiple steps of validationchecks has been successfully passed. By splitting the deployment andvalidation across multiple steps and hardware components, the differentservices of the secure deployment platform such as the requester, thesignature server, the execution server, and the credential vault, amongothers, can be individually monitored for security threats and/orbreaches and provide multiple layers of security. Moreover, the addedsecurity and flexibility of the disclosed secure deployment platformallow a customer to improve on the management of management serviceinstances without the additional overhead and costs typically associatedwith administrative tasks. Complex security operations including theselection of cryptography ciphers, generation ofpublic/private/symmetric keys, secure storage and usage of keys, supportfor security auditing, and support for security compliance, etc. arehandled and/or supported by the secure deployment platform and are madeaccessible to customers who may have little domain knowledge in computersecurity.

In some embodiments, an encrypted version of a digital signature privatekey is received. For example, a signature server receives a private keywrapped with a key enchipherment key. The private key and itscorresponding public key/certificate may utilize an Edwards-curvedigital signature algorithm or another appropriate digital signaturescheme. In some embodiments, the key enchipherment key is stored on acredential vault separate from the signature server. In someembodiments, a request to sign a provided payload is received. Thepayload includes an automation script specified to execute on one ormore management service instances. For example, an automation script ispassed by a requester service to the signature server for signing. Insome embodiments, the automation script is validated, including bymodifying the payload to add metadata data associated with thevalidation to the payload. For example, the requester requesting thesigning is validated along with the set of management service instances.Validation checks can include checking a domain, sub-domain, and/or IPaddress whitelist for both the requester and service instances forpermission to execute the script on the corresponding instances. In someembodiments, the validation includes updating the payload with metadataof the validation such as including the validated management serviceinstances targeted for executing the script. The metadata can alsoinclude execution run as settings, such as the user roles, permissions,and/or associated privilege settings for executing the script on thecorresponding targets. The payload can also include an expiration timeor expiration count. For example, the payload can be configured toexpire at a certain time, after a certain time, or after an executioncount has been met. In some embodiments, the execution configuration isstored in a security token. For example, the required token can bevalidated by an execution server before executing the script on thecorresponding target instances.

In some embodiments, the encrypted version of the digital signatureprivate key is sent to a credential system. For example, a credentialvault storing the key enchipherment key receives the encrypted versionof the digital signature private key and decrypts the digital signatureprivate key. In some embodiments, an unencrypted version of the digitalsignature private key that is valid for a limited amount of time isreceived from the credential system. For example, the credential vaultsends the unwrapped digital signature private key to the signatureserver. In some embodiments, the unwrapped digital signature private keyis only valid for a limited amount of time, such as 300 seconds oranother appropriate time limit. For example, the unwrapped digitalsignature private key may be cached for only the specified limitedamount of time before it is expired and deleted. In some embodiments,once the key is expired, the signature server will have to request thatthe encrypted version of the digital signature private key be againunwrapped.

In various embodiments, the unencrypted version of the digital signatureprivate key is used to sign the modified payload. For example, theunwrapped private key can be used to sign the security token of thepayload to confirm that the payload is validated. In some embodiments,the signed modified payload is provided in response to the request tosign the provided payload. For example, the signed payload is returnedby the signature server to the requester. The signed modified payload isconfigured to, in response to a request to execute the automation scripton the one or more of the management service instances, be verifiedusing a public key corresponding to the digital signature private key.For example, the signed payload can be verified using the correspondingpublic key/certificate corresponding to the digital signature privatekey by an execution server. The signed modified payload is configured toallow a validation of the automation script at least in part by usingthe included added metadata. For example, using the metadata of thepayload, an execution server can validate whether to deploy and executethe included automation script on the target instances. The targetinstances can be included in the payload and can be validated for accessprivileges. In some embodiments, the signed payload includes expirationinformation to determine whether the script is valid for execution. Forexample, an expiration time of a security token can be checked by anexecution server to determine whether the payload is currently valid.

FIG. 1 is a block diagram illustrating an example of a secure deploymentplatform for automation scripts. In the example shown, secure deploymentplatform 100 includes requester 101, signature server 103, executionserver 105, credential vault 107, and provisioner 109 that arecommunicatively connected to one another via network 151. In variousembodiments, secure deployment platform 100 is part of a cloud-basedservice platform offering multiple service applications including theability to host management service instances. In some embodiments, acustomer accesses secure deployment platform 100 via the cloud-basedservice platform using a client such as a web client. A customer canrequest that an application such as an automation script be deployed andexecuted on a set of customer management service instances (not shown).In some embodiments, a request from a customer client (not shown) isreceived and processed at requester 101. In the event the request isallowed, the executed application results can be returned to thecustomer client via requester 101. In some embodiments, the executedapplication results are written to a results data store such as acustomer database (not shown) managed by the cloud-based serviceplatform.

In some embodiments, requester 101 provides an application, such as anunsigned automation script to execute on a set of target managementservice instances, to signature server 103 for signing. In the event theapplication is validated by signature server 103, requester 101 receivesin return a signed payload that includes the application and validationmetadata. Requester 101 forwards the signed payload to execution server105 and receives the results from executing the application on thetarget instances. In various embodiments, the connection betweenrequester 101 and signature server 103 and between requester 101 andexecution server 105 are each mutually authenticated and each utilize asecure connection protocol such as using HTTPS/TLS or similar protocols.

In some embodiments, signature server 103 validates an applicationreceived from requester 101 for execution on target management serviceinstances. The validation can include validating requester 101 andverifying that the application has no security threats. For example, theapplication can be checked for malware using a static analysis and/orother appropriate techniques. In the event the application is validated,signature server 103 generates a signed payload containing theapplication and additional data associated with the validation. In someembodiments, the signed payload is a signed token containing theapplication and metadata data. In various embodiments, signature server103 signs the payload using a private key. The private key can be storedas an encrypted version of a digital signature private key. In someembodiments, the encrypted version of the digital signature private keyis stored on a local data store (not shown) of signature server 103using a protected format. For example, the encrypted version of adigital signature private key can be stored in a key vault of signatureserver 103 as a passphrase-protected object.

In some embodiments, signature server 103 retrieves the unencryptedversion of a digital signature private key by first providing theencrypted version of the key to credential vault 107 and receiving theunencrypted version in return. In various embodiments, the unencryptedversion of the private key may be cached by signature server 103 for alimited amount of time before being expired. For example, a valid cachedunencrypted key can be used instead of requesting the encrypted key beagain decrypted. Once expired, however, the memory associated with theunencrypted key can be wiped and the encrypted key must be againdecrypted before a new payload can be signed.

In various embodiments, as part of a provisioning step, signature server103 receives from provisioner 109 the encrypted version of a digitalsignature private key and an associated passphrase for securely storingthe encrypted key locally. By only storing an encrypted version of thedigital signature private key, the overall security of the platform isincreased. In some embodiments, the unencrypted version of the privatekey is only stored in volatile memory and for only a limited amount oftime.

In some embodiments, execution server 105 receives and validates asigned payload from requester 101. In some embodiments, the signedpayload is a signed security token. Execution server 105 can validatethe origin of the request using a whitelist and/or other appropriatetechniques along with whether access to the target management serviceinstances specified in the payload is appropriate. At least in part toverify the authenticity of the signed payload, execution server 105utilizes the public key/certificate corresponding to the digitalsignature private key used to sign the payload. Using the publickey/certificate and metadata of the payload, execution server 105 canvalidate the signed payload for authenticity and integrity and determinewhether to deploy the application on target instances. In someembodiments, the metadata includes information utilized by executionserver 105 such as token expiration information and applicationexecution configuration settings. If the signed payload is validated,execution server 105 deploys the application to the appropriate targetmanagement service instances and gathers the corresponding applicationresults. The results are then returned to requester 101.

In some embodiments, a key identifier is extracted by execution server105 from the received signed payload and used to retrieve thecorresponding public key or certificate. For example, a key identifiercan be used to retrieve the corresponding public key/certificate from akey store residing locally on extraction server 105 or located remotely.Once retrieved, the public key/certificate can be used to validate asigned payload.

In some embodiments, execution server 105 receives the public key fromprovisioner 109 and stores the key locally for retrieval when needed.For example, execution server 105 receives the public key fromprovisioner 109 and stores the key as an unprotected cryptography objectin a local key store. In various embodiments, the corresponding publicand private key pairs are stored in separate locations. In variousembodiments, a certificate corresponding to the public key is usedinstead of only the public key.

In some embodiments, credential vault 107 is a credential system formanaging cryptographic keys and corresponding encryption/decryptiontasks. For example, credential vault 107 is a key management system thatcan store a key enchipherment key used to encrypt a private key, such asthe digital signature private key used by signature server 103. In someembodiments, credential vault 107 encrypts a private key using a storedkey enchipherment key provided by provisioner 109. For example,provisioner 109 can generate a public/private key pair and acorresponding key enchipherment key. Provisioner 109 utilizes credentialvault 107 to encrypt the private key using the key enchipherment key. Inresponse, credential vault 107 provides provisioner 109 with a wrappedprivate key. When credential vault 107 is later provided with thewrapped private key, credential vault 107 can return the unwrappedversion of the private key. For example, signature server 103 canprovide credential vault 107 with a wrapped digital signature privatekey and, if appropriate, credential vault 107 will return the unwrappedprivate key utilizing the appropriate key enchipherment key.

In some embodiments, provisioner 109 is used to perform many of thecryptographic key provisioning steps for secure deployment platform 100.For example, provisioner 109 can generate and distribute the appropriatekeys to the appropriate components of secure deployment platform 100. Insome embodiments, provisioner 109 is used to generate a private/publickey pair and a corresponding key enchipherment key for encrypting theprivate key. Provisioner 109 provides the key enchipherment key tocredential vault 107 for storing. Provisioner 109 also provides theprivate key to credential vault 107 to be wrapped with the provided keyenchipherment key. The wrapped private key is then sent by provisioner109 to signature server 103. In some embodiments, provisioner 109 alsoprovides to signature server 103 a passphrase for protecting the wrappedprivate key in a key store. Provisioner 109 sends the correspondingpublic key/certificate to execution server 105.

In the example shown, network 151 can be a public or private network. Insome embodiments, network 151 is a public network such as the Internet.In some embodiments, network 151 is composed of multiple networks and isconfigured to prevent one or more components shown in FIG. 1 from beingaccessed by outside clients and/or the other components of securedeployment platform 100. For example, in some embodiments, credentialvault 107 and provisioner 109 may be located in a separate privatenetwork of network 151 where access is severely restricted. Network 151may be configured such that requester 101 can not access credentialvault 107 and/or provisioner 109 and that the only components of securedeployment platform 100 that requester 101 can access are signatureserver 103 and execution server 105. As another example, network 151 maybe configured such that execution server 105 cannot access credentialvault 107. In various embodiments, the connections between the differentcomponents of secure deployment platform 100 are secure connections.

Although single instances of some components have been shown to simplifythe diagram, additional instances of any of the components shown in FIG.1 may exist. For example, requester 101 may correspond to one or moreservers. As another example, in some embodiments, multiple executionservers can exist, each co-located at a different data center with adifferent set of management service instances. In some embodiments,components not shown in FIG. 1 may also exist. For example, signatureserver 103 and/or execution server 105 can each include local (orremote) stores (not shown) for storing key and/or validationconfiguration data such as whitelists.

FIG. 2 is a flow chart illustrating an embodiment of a process forsecurely deploying an automation script to execute on management serviceinstances. For example, a customer utilizing a cloud-based serviceplatform can utilize the process of FIG. 2 to remotely managecloud-based service instances by deploying custom automation scriptsthat run directly on the customer's instances. Although a cloud-basedplatform can provide standard management functionality, a customer mayneed the additional functionality that only a custom automation scriptrunning directly on its management service instances can provide. Forexample, a customer may want to query each of its instances to gatherspecific operating metrics, to update or install software packages, toconfigure hardware or hardware drivers, or to perform anotherappropriate task. In some embodiments, the scripts are deployed to asecure deployment platform where the script is validated and securelydeployed to each of the instances while minimizing security threats. Insome embodiments, the secure deployment platform is secure deploymentplatform 100 of FIG. 1 .

At 201, an automation script is created. For example, a customer createsan automation script to perform administrative tasks on customermanagement service instances. The automation script is created to run onthe instances and can perform tasks such as configuration tasks,management tasks, analytics tasks, etc. In various embodiments, thesecure deployment platform allows an executed automation script toreturn results. For example, an automation script can be created toquery and return configuration settings for each target instance. Asanother example, an automation script can be created to gatherperformance metrics for each target instance. In some embodiments, aspart of the creation process, the script is analyzed for security risks.For example, the created automation script can be analyzed for malwareor other security threats. In some embodiments, an automation script isreceived by the cloud-based service platform where it undergoes malwareanalysis such as static malware analysis as one step in the validationprocess.

At 203, the automation script is deployed to target instances. Forexample, the automation script is received at a cloud-based serviceplatform using a secure deployment platform. In some embodiments, thecustomer specifies the target management service instances on which toexecute the approved automation script. The instances can be hardwareservers including virtual hardware instances managed by the customer viathe cloud service platform. The secure deployment platform validates theautomation script, for example, to confirm that the customer has theproper access to run the automation script on the target instances. Thecustomer can also specify execution configuration settings such as theuser and/or execution permissions used to execute the script. In someembodiments, the received automation script is analyzed for malwareand/or other security threats. In various embodiments, once validated,the secure deployment platform deploys the automation script to thetarget instances and returns automation script results.

At 205, automation script results are collected. For example, theresults of running the automation script on the specified targetmanagement service instances are collected. In some embodiments, theresults are returned directly to the customer via a user interface suchas a web user interface to the cloud-based service platform. In someembodiments, the results are written to a data store such as a customerdatabase.

FIG. 3 is a flow chart illustrating an embodiment of a process forsecurely deploying an automation script to execute on management serviceinstances. Using the process of FIG. 3 , a secure deployment platform isfirst provisioned and then receives and deploys automation scripts. Invarious embodiments, the process of FIG. 3 is run on a secure deploymentplatform to deploy automation scripts to a set of target managementservice instances. The secure deployment platform includes requester,signature server, execution server, credential system, and provisionercomponents. In some embodiments, the secure deployment platform issecure deployment platform 100 of FIG. 1 and the requester, signatureserver, execution server, credential system, and provisioner componentsare requester 101, signature server 103, execution server 105,credential vault 107, and provisioner 109, respectively, of FIG. 1 . Insome embodiments, the steps 303 and/or 305 are performed at 203 of FIG.2 and the step of 307 is performed at 203 and/or 205 of FIG. 2 .

At 301, a secure deployment platform is provisioned. For example,cryptographic keys are generated and distributed to the appropriatecomponents of the secure deployment platform. In some embodiments, aprovisioner generates a public and private key pair along with a keyenchipherment key to encrypt the private key. The key enchipherment keyis stored at a credential system. In some embodiments, the credentialsystem also encrypts the private key. The encrypted private key isstored at a signature server and the public key/certificate is stored atan execution server. In some embodiments, the whitelist and/or othervalidation databases are updated and pushed to the various componentssuch as the requester, signature server, and/or execution server toauthenticate and validate connections and requests. In some embodiments,the keys stored by the signature server and execution server are storedin key stores which may be potentially unprotected for the case ofpublic keys/certificates for the execution server or protected using apassphrase or another technique for the signature server. At 301, thekey stores can be configured and initialized.

At 303, an automation script is received. For example, an automationscript is received along with a set of target management serviceinstances on which the automation script should execute. In someembodiments, additional execution configuration settings such as a runas setting describing the user and/or permissions to apply when runningthe automation script are received along with the script. In someembodiments, the automation script is received at a requester or by arequester service.

At 305, the automation script is validated and a corresponding payloadis prepared. For example, the script is validated to confirm the script,requester, and target instances meet the appropriate security profile.In some embodiments, the validation includes applying one or morewhitelists such as domain, sub-domain, and/or IP address whitelists. Inthe event the script and execution request are validated, a payloadincluding the script and validation metadata is prepared. In someembodiments, the payload is signed using a private key and the signedpayload is forwarded to an execution server.

At 307, the script is executed for the target instances using the signedpayload. For example, the automation script is extracted from a signedpayload and validated. The validation can include validating therequester and deployment instances. In some embodiments, the signedpayload includes a security token used for validation. In the event thescript and execution request are validated, the automation script isdeployed to the target instances and executed. The results from eachexecution are gathered. In some embodiments, the results are returned tothe original requester and/or written to a designated results datastore.

FIG. 4 is a flow chart illustrating an embodiment of a process forprovisioning a secure deployment platform for automation scripts. Usingthe process of FIG. 4 , a secure deployment platform is provisioned toaccept and validate automation scripts for deployment at targetmanagement service instances. The provisioning steps include thegeneration and distribution of cryptographic keys to the variouscomponents of the secure deployment platform. In some embodiments, thesecure deployment platform is secure deployment platform 100 of FIG. 1 .In some embodiments, the process of FIG. 4 is performed at 301 of FIG. 3.

At 401, cryptographic keys are generated. For example, a public andprivate digital signature key pair along with a key enchipherment key(KEK) to encrypt the private key are generated. In some embodiments, thepublic/private key pair utilize an Edwards-curve digital signaturealgorithm or another appropriate digital signature scheme. In someembodiments, the KEK utilizes a symmetric-key algorithm. In someembodiments, the keys and corresponding certificate are generated by aprovisioner component. In some embodiments, the provisioner component isprovisioner 109 of FIG. 1 .

At 403, the key enchipherment key (KEK) is transmitted to a credentialvault. For example, the KEK generated at 401 is transmitted by aprovisioner component to a credential vault. The credential vault canhave improved security and monitoring and stores the KEK until it isneeded. In some embodiments, the credential vault is credential vault107 of FIG. 1 . In some embodiments, once the KEK is transmitted to thecredential vault, the provisioner component no longer keeps a copy ofthe KEK.

At 405, the private key is wrapped with the key enchipherment key (KEK).For example, the private digital signature key generated at 401 isencrypted using the KEK generated at 401. In various embodiments, theprivate key is wrapped for the provisioner component by transmitting theprivate key to the credential vault. The credential vault encrypts theprivate key using the KEK and returns a wrapped private key to theprovisioner component. In some embodiments, once the private key istransmitted to the credential vault, the provisioner component no longerkeeps a copy of the private key.

At 407, the public key/certificate is transmitted to an executionserver. For example, the public digital signature key generated at 401is transmitted by the provisioner component to an execution server. Insome embodiments, a digital signature certificate containing the publicdigital signature key is transferred to the execution server. The publickey can be stored in a key store by the execution server. The key storecan be a local or remote key store to the execution server. In variousembodiments, the public key/certificate can be stored in an unprotectedor protected key store. In some embodiments, once the public key istransmitted to the execution server, the provisioner component no longerkeeps a copy of the public key. In some embodiments, multiple executionservers exist in the secure deployment platform and each receives a copyof the public key or corresponding certificate.

At 409, the wrapped private key is transmitted to a signature server.For example, the private digital signature key wrapped at 405 istransmitted by the provisioner component to a signature server. Theencrypted private key can be stored in a protected key store by thesignature server. The key store can be a local or remote key store tothe signature server. In various embodiments, the encrypted private keyis protected using a passphrase or another appropriate technique. Insome embodiments, once the wrapped private key is transmitted to thesignature server, the provisioner component no longer keeps a copy ofthe wrapped private key.

In some embodiments, the passphrases used to protect the keys stored inkey stores are generated by the provisioner component and aredistributed by the provisioner component to the appropriate componentsof the secure deployment platform. For example, the provisionergenerates a passphrase for a protected key store and sends thepassphrase to the signature server for storing the wrapped private keyin its protected key store. In various embodiments, the signature serverstores the passphrase and can utilize the passphrase to access thewrapped private key from its protected key store. In variousembodiments, once the passphrase is transmitted to the appropriatecomponent of the secure deployment platform, the provisioner componentno longer keeps a copy of the generated passphrase. In some embodiments,multiple signature servers exist in the secure deployment platform andeach receives a copy of the wrapped private key and a correspondingpassphrase for storing the wrapped private key. In some embodiments,each signature service has a unique passphrase.

FIG. 5 is a flow chart illustrating an embodiment of a process forsigning an automation script payload. Using the process of FIG. 5 , anautomation script is received at a secure deployment platform andvalidated. Once validated, a payload containing the script andvalidation metadata is signed. The signed payload can be used to executethe script on its target management service instances. In someembodiments, the secure deployment platform is secure deploymentplatform 100 of FIG. 1 . In some embodiments, the process of FIG. 5 isperformed at 303 and/or 305 of FIG. 3 .

At 501, a payload signing request is received. For example, a requestersends a payload signing request that is received at a signature server.In some embodiments, the request is transmitted via a POST request. Theconnection between the requester and signature server can be a mutuallyauthenticated connection. In some embodiments, the signature requestincludes the automation script, the usage mode, an executionconfiguration, and the set of management service instances on which torun the automation script. In some embodiments, the executionconfiguration includes configuration settings such as an execution timewindow.

At 503, the requester and request are validated. For example, therequester and request are validated by the signature server. Thevalidation may include checking that the requester and target managementservice instances are on an IP address whitelist. In variousembodiments, the whitelists can include ranges such as one or more IPaddress ranges. In some embodiments, domain, sub-domain, and/or commonname (CN) whitelists can be utilized as well. In some embodiments, aninstance whitelist is utilized for the target management serviceinstances. For example, each customer and customer account may have aninstance identifier whitelist identifying which users are allowed accessto which instances. In some embodiments, the requester is validated byrequiring a mutually authenticated session using a protocol such asHTTPS/TLS. In the event the requester and request are not bothvalidated, the signature request is denied.

At 505, the automation script is validated. For example, the automationscript is validated by the signature server. The validation may includechecking that the script is non-malicious and/or does not perform anyactions outside its allowable scope. For example, an analysis such as astatic analysis may be performed on the script to detect securitythreats. In some embodiments, a dynamic analysis of the script isperformed in a sandbox. In some embodiments, the script is analyzed inadvance of the process of FIG. 5 . In the event the script is notvalidated, the signature request is denied.

At 507, the wrapped private key is unwrapped. For example, the encryptedversion of the digital signature private key is sent to a credentialsystem such as credential vault 107 of FIG. 1 to be decrypted. Anunwrapped version of the wrapped private key is returned to thesignature server. In some embodiments, the unwrapped key may only bevalid for a limited amount of time. For example, the signature serverreceives the unencrypted version of the digital signature private keyfrom the credential system and caches the unwrapped key for a limitedamount of time such as 300 seconds or another appropriate time length.If another valid signature request is received while the unwrapped keyis still valid, the signature server can use the cached unwrapped key.In some embodiments, once the unwrapped key is no longer valid, it isexpired and purged. For example, the memory used to store the unwrappedkey is wiped. In some embodiments, the unwrapped key is expired after ithas been used for signing more than a threshold number of times. Forexample, a threshold limit is configured to expire the unwrapped keyonce the unwrapped key has been used the threshold number of times.

In some embodiments, before the wrapped key can be decrypted by acredential system, the wrapped key must first be retrieved from aprotected key store. For example, the wrapped key may be stored in aprotected key store that can only be accessed using a passphrase. Oncethe wrapped key is retrieved from the key store using the passphrase,the wrapped key is transmitted to the credential system.

At 509, a signed payload is generated. For example, a payload includingthe validated script and validation metadata is signed using the digitalsignature private key unwrapped at 507. In some embodiments, the payloadincludes metadata information such as the list of target managementservice instances, the requester, execution configuration settings,and/or run as settings, among others. For example, an executionconfiguration setting can include an expiration time for a totalallowable execution count for executing the automation script. In someembodiments, the execution configuration includes an execution timewindow or similar execution configuration. For example, the signedpayload can be configured to allow it to be executed once (e.g.,one-time), multiple-times, or based on a time and execution window, oranother appropriate execution configuration.

In some embodiments, the signed payload is a signed security token. Theadditional metadata can include the issuer of the token, a subject(e.g., validated script), an audience (e.g., target instance(s)), anexpiration time, a not valid before time, an issue time, a unique tokenidentifier, and a key identifier, among other settings. For example, thekey identifier can be used to retrieve the corresponding public key orcertificate from a key store. Additional metadata can include accesspermissions for the script such as read, write, download, execute, orother appropriate permissions. In some embodiments, the payload or tokencan include custom metadata. For example, custom metadata can beincluded in the payload using a key:value format.

At 511, the signed payload is returned. For example, the signed payloadis returned by the signature server to the requester or requesterservice. Once signed, the payload can be forwarded to an executionserver where the payload can be verified and the automation scriptdeployed to execute on the target instances.

FIG. 6 is a flow chart illustrating an embodiment of a process forexecuting a signed automation script payload. Using the process of FIG.6 , a signed payload that includes at least an automation script isprocessed by a secure deployment platform. The signed payload isforwarded by a requester to an execution server. The execution servervalidates the signed payload and executes the associated automationscript if valid. Return results are gathered at the execution server andprovided to the requester. In some embodiments, the secure deploymentplatform is secure deployment platform 100 of FIG. 1 . In someembodiments, the process of FIG. 6 is performed at 307 of FIG. 3 .

At 601, a signed payload is received. For example, a signed payload thatincludes an automation script and validation metadata is received at anexecution server. In some embodiments, the signed payload is a signedsecurity token used to validate the signed payload. The signed payloadmay be signed at a signature server using the process of FIG. 5 andforwarded to the execution server from a requester.

At 603, the request origin is validated. For example, the request originis validated by the execution server using a whitelist such an IP oranother appropriate whitelist. In some embodiments, the request originis included in the signed payload.

At 605, a key identifier is extracted from the payload. For example, akey identifier is extracted from the signed payload by the executionserver. The key identifier is associated with the certificate thatcorresponds to the digital signature private key used to sign thepayload.

At 607, a digital signature certificate is retrieved. Using the keyidentifier extracted at 605, the corresponding digital signaturecertificate is retrieved. In some embodiments, the digital signaturecertificate or public key is stored in a key store associated with theexecution server. In various embodiments, the key identifier is used toretrieve the proper certificate. In some embodiments, a validationstatus is retrieved instead of a certificate.

At 609, the signed payload and the payload data are validated. Forexample, the signed payload is validated by the execution server usingthe certificate retrieved at 607. In some embodiments, the payload is asecurity token with a token issuer, token subject, token audience,expiration time, not valid before time, issue time, and token uniqueidentifier, among other metadata. Using the token (or similar payload)validation metadata, the payload is validated. For example, the token isnot valid if expired or if the current time is before the not validbefore time. In some embodiments, a token is a single-use token and isinvalid if replayed.

Once the signed payload is validated, the data of the payload includingadditional validation metadata is validated. For example, the validationmetadata includes a list of target management service instances andexecution configuration settings. An additional check can be performedto confirm the requester has access to the target instances. In someembodiments, the execution configurations include user and/or userpermissions to use when executing the script.

At 611, the automation script is executed for the target instances andthe return results are returned. For example, the automation script andlist of target management service instances are extracted from thevalidated payload. The automation script is deployed to the targetinstances and executed. In some embodiments, the execution usesspecified execution configuration settings included in the payload suchas run as settings. The execution settings can include a user accountand/or associated access privileges for executing the automation script.Once the automated script has completed its execution, the returnresults of the automation script are gathered and provided to therequester. In the event the script is not successfully executed, anappropriate error return result is sent to the requester.

FIG. 7 is a block diagram illustrating the execution and communicationprocess for securely deploying an automation script to execute onmanagement service instances. The diagram of FIG. 7 illustrates theinteractions of the different components of a secure deployment platformin response to a request to deploy an automation script to execute ontarget instances. Using the components of the secure deploymentplatform, the request is validated and a signed payload including theautomation script and validation data is generated. The signed payloadis used to deploy the automation script on the target instances. In someembodiments, the secure deployment platform is secure deploymentplatform 100 of FIG. 1 . In some embodiments, the processes of FIGS. 5and 6 follow the execution and communication process of the blockdiagram of FIG. 7 . For example, in some embodiments, the process ofFIG. 5 utilizes components requester 701, signature server 703, andcredential vault 705 and the process of FIG. 6 utilizes componentsrequester 701, execution server 703, and key store 709.

In the example shown, processing initiates at requester 701 with arequest (not shown) for deploying an automation script. In response tothe initial request, requester 701 sends signature request 711 tosignature server 703. Signature request 711 includes at least theautomation script and a list of target management service instances. Atsignature server 703, validation is performed on the request andrequester. In some embodiments, the validation is performed at 503and/or 505 of FIG. 5 . If valid, signature server 703 retrieves anencrypted version of the digital signature private key from a key store(not shown). Signature server 703 initiates unwrap request 713 tocredential vault 705 to unwrap the encrypted version of the digitalsignature private key. Credential vault 705 includes in unwrap response715 the unencrypted version of the digital signature private key. Oncethe unwrapped private key is received at signature server 703, signatureserver 703 generates a signed payload that includes the automationscript and validation metadata including a key identifier and the targetmanagement service instances. The signed payload is included insignature request response 717 that signature server 703 transmits torequester 701.

In response to receiving signature request response 717, requester 701forwards signature request response 717 as signed payload message 721 toexecution server 707. Execution server 707 validates the originassociated with signed payload message 721 and extracts the keyidentifier from the included signed payload. The key identifier is usedto generate certificate request 723 that is sent to key store 709. Insome embodiments, key store 709 is a local key store but can be a remotekey store as appropriate. The certificate corresponding to the keyidentifier is retrieved from key store 709 and included in certificateresponse 725. Execution server 707 uses the certificate of certificateresponse 725 to validate the signed payload of signed payload message721 and also the data within the signed payload. In some embodiments,the validation is performed at 609 of FIG. 6 . Once validation iscomplete, execution server 707 deploys the automation script to thetargeted management service instances (not shown). The automation scriptis executed on the corresponding instances and script results arereturned to execution server 707. Execution server 707 transmits theautomation script results to requester 701 as automation script resultsmessage 727. In some embodiments, requester 701 forwards the automationscript results to the initiator of the automation script deploymentrequest.

FIG. 8 is a diagram illustrating the process of securely deploying anautomation script to execute on management service instances. Thediagram of FIG. 8 illustrates the interactions of the differentcomponents of a secure deployment platform starting with theprovisioning of the secure deployment platform and responding to arequest to execute an automation script on target management serviceinstances. In some embodiments, the secure deployment platform is securedeployment platform 100 of FIG. 1 . In the example shown, the securedeployment platform includes requester 801, signature server (Arwen)803, execution server 805, credential vault 807, and provisioner 809. InFIG. 8 , signature server 803 is also referenced as Arwen.

In some embodiments, the provisioning steps are shown as steps 1-7. Theprovisioning steps include the generation and distribution ofcryptographic keys by provisioner 809. In particular, an encryptedversion of the digital signature private key is stored at signatureserver (Arwen) 803 and a corresponding public key/certificate is storedat execution server 805. The key enchipherment key (KEK) used to encryptthe digital signature private key is stored at credential vault 807. Invarious embodiments, the provisioning steps are performed at 301 of FIG.3 and/or correspond to the process of FIG. 4 .

In some embodiments, the steps for signing an automation script payloadare shown as steps 8-11. A signed payload that includes the automationscript is generated by signature server 803 in the event the automationscript is authorized to execute on the requested target managementservice instances. In particular, the signature request steps includerequesting a signature request by requester 801 from a signature server803, validating the request, retrieving an unencrypted version of thedigital signature private key from credential vault 807, and generatinga signed payload once the request and script have been validated.Signature server 803 sends the generated signed payload to requester801. In various embodiments, the steps for signing an automation scriptpayload are performed at 303 and/or 305 of FIG. 3 and/or correspond tothe process of FIG. 5 .

In some embodiments, the steps for executing a signed automation scriptpayload are shown as steps 12-15. In particular, a signed payloadforwarded by requester 801 is validated at execution server 805 using acorresponding certificate. In the example shown, the certificate orpublic key is retrieved from a key store of a local filesystem ofexecution server 805. The certificate can be retrieved using a keyidentifier stored in the signed payload. The payload and payloadmetadata are validated. Once validation is completed, the automationscript is executed on target instances such as glide nodes and theresults returned to requester 801. In various embodiments, the steps forexecuting a signed automation script payload are performed at 307 ofFIG. 3 and/or correspond to the process of FIG. 6 .

Although the foregoing embodiments have been described in some detailfor purposes of clarity of understanding, the invention is not limitedto the details provided. There are many alternative ways of implementingthe invention. The disclosed embodiments are illustrative and notrestrictive.

What is claimed is:
 1. A method, comprising: receiving an encrypted version of a digital signature private key; receiving a request to sign a provided payload, wherein the payload includes an automation script specified to execute on one or more management service instances; validating the automation script, including by modifying the payload to add, by a first-party, metadata associated with the validation to the payload that includes the automation script specified at least in part by a third-party different from the first-party of the added metadata; sending the encrypted version of the digital signature private key to a credential system; receiving from the credential system, an unencrypted version of the digital signature private key that is valid for a limited amount of time; using the unencrypted version of the digital signature private key to sign the modified payload including the automation script and the added metadata; and providing the signed modified payload in response to the request to sign the provided payload, wherein the signed modified payload is configured to, in response to a request to execute the automation script on the one or more of the management service instances, be verified using a public key corresponding to the digital signature private key and allow a validation of the automation script at least in part by using the included added metadata.
 2. The method of claim 1, wherein the added metadata associated with the validation to the payload includes an execution configuration, a run as setting, and at least one identifier of the one or more of the management service instances.
 3. The method of claim 2, wherein the execution configuration is stored in a security token.
 4. The method of claim 2, wherein the execution configuration specifies an expiration time or a total allowable execution count, and wherein the execution configuration is associated with one or more instances of the automation script executing on the one or more management service instances.
 5. The method of claim 4, wherein the total allowable execution count is one.
 6. The method of claim 4, wherein the expiration time is a time limit.
 7. The method of claim 1, further comprising storing the received encrypted version of the digital signature private key on a local data store in a protected key store.
 8. The method of claim 7, further comprising receiving a passphrase for the protected key store.
 9. The method of claim 1, wherein the unencrypted version of the digital signature private key is stored in a local cache for the limited amount of time.
 10. The method of claim 9, further comprising expiring the unencrypted version of the digital signature private key from the local cache after the limited amount of time has passed.
 11. The method of claim 9, further comprising expiring the unencrypted version of the digital signature private key after the unencrypted version of the digital signature private key has been used for signing more than a threshold number of times.
 12. The method of claim 1, further comprising validating a requester of the request to sign the provided payload.
 13. The method of claim 12, wherein the validation of the requester includes a session validation and a whitelist validation.
 14. The method of claim 13, wherein the session validation is mutually authenticated.
 15. The method of claim 13, wherein the whitelist validation includes a domain, a sub-domain, or an IP address whitelist validation.
 16. The method of claim 15, wherein the IP address whitelist validation includes an IP address range.
 17. The method of claim 1, wherein validating the automation script includes analyzing the automation script to detect a security threat.
 18. The method of claim 1, wherein the automation script specified to execute on the one or more management service instances is configured to provide a return result to an execution requester of the automation script.
 19. A system, comprising: a processor; and a memory coupled to the processor, wherein the memory is configured to provide the processor with instructions which when executed cause the processor to: receive an encrypted version of a digital signature private key; receive a request to sign a provided payload, wherein the payload includes an automation script specified to execute on one or more management service instances; validate the automation script, including by modifying the payload to add, by a first-party, metadata associated with the validation to the payload that includes the automation script specified at least in part by a third-party different from the first-party of the added metadata; send the encrypted version of the digital signature private key to a credential system; receive from the credential system, an unencrypted version of the digital signature private key that is valid for a limited amount of time; use the unencrypted version of the digital signature private key to sign the modified payload including the automation script and the added metadata; and provide the signed modified payload in response to the request to sign the provided payload, wherein the signed modified payload is configured to, in response to a request to execute the automation script on the one or more of the management service instances, be verified using a public key corresponding to the digital signature private key and allow a validation of the automation script at least in part by using the included added metadata.
 20. A computer program product, the computer program product being embodied in a non-transitory computer readable medium and comprising computer instructions for: receiving an encrypted version of a digital signature private key; receiving a request to sign a provided payload, wherein the payload includes an automation script specified to execute on one or more management service instances; validating the automation script, including by modifying the payload to add, by a first-party, metadata associated with the validation to the payload that includes the automation script specified at least in part by a third-party different from the first-party of the added metadata; sending the encrypted version of the digital signature private key to a credential system; receiving from the credential system, an unencrypted version of the digital signature private key that is valid for a limited amount of time; using the unencrypted version of the digital signature private key to sign the modified payload including the automation script and the added metadata; and providing the signed modified payload in response to the request to sign the provided payload, wherein the signed modified payload is configured to, in response to a request to execute the automation script on the one or more of the management service instances, be verified using a public key corresponding to the digital signature private key and allow the validation of the automation script at least in part by using the included added metadata. 